From nobody Fri Oct 23 14:30:37 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=oss.qualcomm.com ARC-Seal: i=1; a=rsa-sha256; t=1792161083; cv=none; d=zohomail.com; s=zohoarc; b=CGQiwvuSa+8Xc+QXUrq1Xo367YEo/UhpX+hL19qVljdgLuH8uTdbSuU0njLJrwi60REL1nQqd1OWimU2r0F9MaUiTQiZGqfRpwepS6a/V7hIPsckYfcKM+bCleBi7xor1rjRXre8XnBXgKideoSn6qeCSUudx7G/7sZZhhWqeMo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792161083; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=ErIh37paV1OV8hiktUkXTzxm1Lhi/fmffGycEAw7WF0=; b=joAZZkz2Ch//q6RV3UH+gqGnd6dNBwtiNE360kd/Qz0rlyXm56clbVj2MWLztOON6BGUM4OLOb0jIeCuRBeIHAc8elkNZttpPgcDUI4Ekd+yYYwzOdUGCawpEMYw/kAIPwbMclzEylhqJdp0BpIR8RAjxTv/0YM1GzZlM+pueZk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792161083632765.7536401082479; Fri, 16 Oct 2026 07:31:23 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xHiwz-0004o8-De; Fri, 16 Oct 2026 10:30:25 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xHiwv-0004n5-Vd for qemu-devel@nongnu.org; Fri, 16 Oct 2026 10:30:22 -0400 Received: from mx0a-0031df01.pphosted.com ([205.220.168.131]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xHiwt-0007eF-5a for qemu-devel@nongnu.org; Fri, 16 Oct 2026 10:30:21 -0400 Received: from pps.filterd (m0279862.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 69GE5jAi1910963 for ; Fri, 16 Oct 2026 14:30:16 GMT Received: from mail-vk1-f198.google.com (mail-vk1-f198.google.com [209.85.221.198]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4hbjmf8rqq-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Fri, 16 Oct 2026 14:30:16 +0000 (GMT) Received: by mail-vk1-f198.google.com with SMTP id 71dfb90a1353d-5de9d3d00acso2940131e0c.0 for ; Fri, 16 Oct 2026 07:30:16 -0700 (PDT) Received: from hu-bcain-lv.qualcomm.com (Global_NAT1.qualcomm.com. [129.46.96.20]) by smtp.gmail.com with ESMTPSA id 71dfb90a1353d-5ea9b474b2asm1605214e0c.4.2026.10.16.07.30.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Oct 2026 07:30:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= ErIh37paV1OV8hiktUkXTzxm1Lhi/fmffGycEAw7WF0=; b=ED3DN0gzaJ/AjZFE jLyFlLAslx/aVGaVcTVqus3AVbfN+papPcmcHeGQRHhx/7y/ho/9jw3xJetf8C4o DE7Is9r8VAelOtd4yzbMnLao449n8IWQKo2s6olvFSSFGuXxKP2zqHZ2MDzEBKuP 0vjmrh8gv7fc17LvuXTCmQ/nQ+LtIahwmAEYW9FHtZ/xx4Il8bgUBFoxIR7kmj9P ofaop8TWPyMz4lfpvMa80S4ivX1Lt8vMaUcVonhqwNVpmB1/lCwdTNhg2/cYUvHK yBiJUXBfJm9xV7rjuViK8wdFnxI0Nq96vE01CBRl6NXwZkCNd6QbYdEBzipW0tAk iao9zw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1792161015; x=1792765815; darn=nongnu.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=ErIh37paV1OV8hiktUkXTzxm1Lhi/fmffGycEAw7WF0=; b=eTffooJLIzAYv4jJIdB1WdD1XT3loNz8VNxex/aqBT4zJmdkopS05qOmYV9W4xNZqv JxBVsd0lwz9+iiLYREM87VU5K9oUDtRrqWvBQ7aMf3y5kaBUOwZVZrPsnLVRVJIGBZw1 DN0kAFUVlT304j5emZqJEHfoso8e4QlzV8E3Gwa9LNiKqtEbqBERANn7haTX6RJB6DZ2 TkN18kAqiB3JyJW8pyLuRdcZGohGQW7qPBsOAqYAGz+8WJoUtYO8C9nAwxdrqSx0S2CP ZgDIy/Xs4V+hsDO7E/19bZXLoPPLeIPNKgr0z5v5raHvAsB0/cs6DjWJJjyVLMCea2+S uxPw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792161015; x=1792765815; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=ErIh37paV1OV8hiktUkXTzxm1Lhi/fmffGycEAw7WF0=; b=xhJKS7227fsQeL0y0sqxEFGgsvHRJHkC7/tzCPKPCYf3INKVYJw/6917d1Gh5Vbt+K 8y0hgSU68MeDbkqCQsspEDN4Ll9wC2J2P2nXx+RR8msXpZG74lJsHPNv2U4dHmi0snO9 UcwPYCpmCST1OElQi4FZoyTtSU6ppf+8e8upP/ZK4IdNCE+/dlFi9Qxomu3jqi2gI6T+ 7HiyIFYoMBzBagAgj/KYeMLWJCQGzmM0rg9TZGxrwaiwXlGO2VGllIN2kkMz6sCaEZEh PHVpzhEzDFjnqtCmlap7DfDIW3Ui7ndWa8PexqNXhAzhPwC7a678SIU/pes0CAGzz6B8 n37A== X-Gm-Message-State: AFq9FYLmp5iPFP4zP/Vm6RTmFtbWHZU9CYXo/2/48OlqnA88UaMyuVHN y4FcP6b/4cad9TfVW8xHQkVnMfjGjn8BL89sAwXTBhqLnYpxZkeMJnhzVAZ+Sb4IIWrMZAt7fGp NtzkKCbXwpK4xARHnkhlbjTrXlbF5TLKDXRYdc0ip15cAYN92mYJPuGmW8OjFPOkURQ== X-Gm-Gg: AYBFou3tW5oyfgzDd7TL+buw898v85x5jwBT5X7q3eX0Sf3Xybgzt3VqGxxAGu2ckV3 Ff/z0+WDkDKoS5e/ZCJsYwuo92wcb2zLoh8tocOQa7BAe09hiE1kYr6lik27xs0S5eJgTrvXFeS BuzbJQur+cwqvynORYFUjJScE8R3rB+aUhyeL5LvnGCOoOXLNRtUO+Ux7AFCgXDen7fW9+thToK 0OicgPO7Xe7Onfe1J2zZuHnnY0kTUlok+tFDfvyZGj9o/yIxTtAg57/PILL26K4p3iIHzGksA8I p7jBoZR7XkAwsyMSYIOIhlZ1ak8meTBIPTyo4BWGOcMVqFQh74UNF3NkTxi0qOB0exMdIg027B/ B/hv/6JTQ/RNYTkwJ1ST2MvCrvRzw4M8iQMZceUyJluIM6tI= X-Received: by 2002:a05:6122:3d4b:b0:5ea:4ce1:95ea with SMTP id 71dfb90a1353d-5eaaa0fd8d9mr122078e0c.1.1792161013866; Fri, 16 Oct 2026 07:30:13 -0700 (PDT) X-Received: by 2002:a05:6122:3d4b:b0:5ea:4ce1:95ea with SMTP id 71dfb90a1353d-5eaaa0fd8d9mr121971e0c.1.1792161011850; Fri, 16 Oct 2026 07:30:11 -0700 (PDT) From: Brian Cain To: qemu-devel@nongnu.org Cc: philmd@oss.qualcomm.com, Pierrick Bouvier , peter.maydell@linaro.org, Brian Cain Subject: [PATCH v4 1/4] target/hexagon: use get_user*() for semihosting arguments Date: Fri, 16 Oct 2026 07:30:04 -0700 Message-Id: <20261016143007.3474704-2-brian.cain@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20261016143007.3474704-1-brian.cain@oss.qualcomm.com> References: <20261016143007.3474704-1-brian.cain@oss.qualcomm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Proofpoint-GUID: B4aeIf__TRwzJVq_GNIrdMZl18BtTMtV X-Proofpoint-Spam-Info: AW1haW4tMjYxMDE2MDA1NyBTYWx0ZWRfX6mKlKQq9cjon cmtJu7QAlF/iJnvidjf36r8DfpgHacjI3rX76D/9bKn3eC8VzJgq+Hgf+LvbB15XC6Ry9o72qGl N9imvjxbSuSJx8LaVx4gyMBu+rTx19o= X-Authority-Analysis: v=2.4 cv=SrAFe/O0 c=1 sm=1 tr=0 ts=6ad234f8 cx=c_pps a=1Os3MKEOqt8YzSjcPV0cFA==:117 a=ouPCqIW2jiPt+lZRy3xVPw==:17 a=IkcTkHD0fZMA:10 a=660iZSQnnn4A:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=_K5XuSEh1TEqbUxoQ0s3:22 a=VwQbUJbxAAAA:8 a=pGLkceISAAAA:8 a=KKAkSRfTAAAA:8 a=EUspDBNiAAAA:8 a=OHM9QerqK7XzSgDXoFkA:9 a=QEXdDO2ut3YA:10 a=hhpmQAJR8DioWGSBphRh:22 a=cvBusfyB2V15izCimMoJ:22 X-Proofpoint-ORIG-GUID: B4aeIf__TRwzJVq_GNIrdMZl18BtTMtV X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDE2MDA1NyBTYWx0ZWRfX3DvV+I3MSl4w /0A/1ikzKLWroqx6jV5qBtd+F6S/HPtUjkZS0uAGrHDehUrFjp8gtW0JYIxsnbiqXsP4k+4qjON oONbFxe1F6ft20JeQkQHYcWLlByNJDuQK88/xAbFig2asD2d74/O9sZBopkjvgq30pImM9NTisd LyBCJE7fk+yGOAT9uN5/JjX59HZqR/boqO6penUvO4eSaVToOY30LxGtdlZUJa8ic2MKbG94Dd8 jshKNQP4162ZlIj4dDBS2fR1OuJZ81Hepy3RXPLC8gEqP9/pWZCK1UgK+BKKgtQVGYzsBBTkSf5 0J1Y0pCoW4ifAsz0tylQwCEywLbXwMudkE5glquYWi575FSOFM38ByQlKnsZkMYpf5ldZGAfAzX PMMBOMXp6w05JL+lu2KEL0N6VSPnRaCgmipoMwXxbgF3E6LgueC9E96YY1uW+BlU9NSFR3aq/sl FB1PgYu5bFB7Cn6VfvA== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-16_02,2026-10-14_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 suspectscore=0 bulkscore=0 spamscore=0 phishscore=0 clxscore=1015 malwarescore=0 priorityscore=1501 adultscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2610080000 definitions=main-2610160057 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=205.220.168.131; envelope-from=brian.cain@oss.qualcomm.com; helo=mx0a-0031df01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @qualcomm.com) X-ZM-MESSAGEID: 1792161086604158500 Link: https://lore.kernel.org/qemu-devel/CAFEAcA9EL10xpPx_0YD-q6YcWWP9-iwcy= G8x0s1yQhKB-XQGXQ@mail.gmail.com/ Suggested-by: Peter Maydell Signed-off-by: Brian Cain Reviewed-by: Peter Maydell --- target/hexagon/cpu_helper.h | 2 - target/hexagon/cpu_helper.c | 48 ++------------------ target/hexagon/hexswi.c | 90 ++++++++++++++++++++++++------------- 3 files changed, 64 insertions(+), 76 deletions(-) diff --git a/target/hexagon/cpu_helper.h b/target/hexagon/cpu_helper.h index 8b1fb98a51a..b261b9177bc 100644 --- a/target/hexagon/cpu_helper.h +++ b/target/hexagon/cpu_helper.h @@ -7,8 +7,6 @@ #ifndef HEXAGON_CPU_HELPER_H #define HEXAGON_CPU_HELPER_H =20 -void hexagon_read_memory(CPUHexagonState *env, target_ulong vaddr, int siz= e, - void *retptr, uintptr_t retaddr); void hexagon_write_memory(CPUHexagonState *env, target_ulong vaddr, int size, uint64_t data, uintptr_t retaddr); void hexagon_peek_memory_range(CPUHexagonState *env, uint32_t start_addr, diff --git a/target/hexagon/cpu_helper.c b/target/hexagon/cpu_helper.c index 6dc06401ad5..c66ad88108d 100644 --- a/target/hexagon/cpu_helper.c +++ b/target/hexagon/cpu_helper.c @@ -28,48 +28,6 @@ =20 #ifndef CONFIG_USER_ONLY =20 -static bool hexagon_read_memory_small(CPUHexagonState *env, target_ulong a= ddr, - int byte_count, uint64_t *data, - int mmu_idx, uintptr_t retaddr) - { - /* handle small sizes */ - switch (byte_count) { - case 1: - *data =3D cpu_ldub_mmuidx_ra(env, addr, mmu_idx, retaddr); - return true; - - case 2: - *data =3D cpu_lduw_le_mmuidx_ra(env, addr, mmu_idx, retaddr); - return true; - - case 4: - *data =3D cpu_ldl_le_mmuidx_ra(env, addr, mmu_idx, retaddr); - return true; - - case 8: - *data =3D cpu_ldq_le_mmuidx_ra(env, addr, mmu_idx, retaddr); - return true; - - default: - /* larger request, handle elsewhere */ - return false; - } -} - -void hexagon_read_memory(CPUHexagonState *env, target_ulong vaddr, int siz= e, - void *retptr, uintptr_t retaddr) -{ - BQL_LOCK_GUARD(); - CPUState *cs =3D env_cpu(env); - unsigned mmu_idx =3D cpu_mmu_index(cs, false); - uint64_t data; - if (hexagon_read_memory_small(env, vaddr, size, &data, mmu_idx, retadd= r)) { - stn_he_p(retptr, size, data); - } else { - cpu_abort(cs, "%s: ERROR: bad size =3D %d!\n", __func__, size); - } -} - static bool hexagon_write_memory_small(CPUHexagonState *env, target_ulong = addr, int byte_count, uint64_t data, int mmu_idx, uintptr_t retaddr) @@ -117,11 +75,13 @@ static inline uint32_t page_start(uint32_t addr) void hexagon_peek_memory_range(CPUHexagonState *env, uint32_t start_addr, uint32_t length, uintptr_t retaddr) { - unsigned int warm; + CPUState *cs =3D env_cpu(env); + unsigned int mmu_idx =3D cpu_mmu_index(cs, false); uint32_t first =3D page_start(start_addr); uint32_t last =3D page_start(start_addr + length - 1); + for (uint32_t page =3D first; page <=3D last; page +=3D TARGET_PAGE_SI= ZE) { - hexagon_read_memory(env, page, 1, &warm, retaddr); + cpu_ldub_mmuidx_ra(env, page, mmu_idx, retaddr); } } =20 diff --git a/target/hexagon/hexswi.c b/target/hexagon/hexswi.c index e7362b56650..bc809594335 100644 --- a/target/hexagon/hexswi.c +++ b/target/hexagon/hexswi.c @@ -28,6 +28,7 @@ #include "semihosting/console.h" #include "semihosting/syscalls.h" #include "semihosting/guestfd.h" +#include "semihosting/uaccess.h" #include "system/runstate.h" =20 /* non-arm-compatible semihosting calls */ @@ -168,14 +169,18 @@ static void init_semihosting_guestfds(void) } } =20 -static void do_preload(CPUHexagonState *env, target_ulong swi_info, bool l= oad) +static bool do_preload(CPUHexagonState *env, target_ulong swi_info) { + CPUState *cs =3D env_cpu(env); uint32_t addr, count; uintptr_t retaddr =3D 0; =20 - hexagon_read_memory(env, swi_info + 4, 4, &addr, retaddr); - hexagon_read_memory(env, swi_info + 8, 4, &count, retaddr); + if (get_user_u32(addr, swi_info + 4) || + get_user_u32(count, swi_info + 8)) { + return false; + } hexagon_peek_memory_range(env, addr, count, retaddr); + return true; } =20 /* Hexagon semihosting errno values */ @@ -429,7 +434,10 @@ static void sim_handle_trap0(CPUHexagonState *env) * the input address. The contents of that buffer will be * directed to the SWI interface. */ - do_preload(env, swi_info, (what_swi =3D=3D HEX_SYS_WRITE)); + if (!do_preload(env, swi_info)) { + semi_cb(cs, -1, EFAULT); + return; + } } /* * ARM-compat semihosting SWI numbers are all <=3D 0x31. @@ -464,26 +472,29 @@ static void sim_handle_trap0(CPUHexagonState *env) char filename[BUFSIZ]; target_ulong physical_filename_addr; unsigned int filemode; - int length; + uint32_t length; int real_openmode; int ret, err =3D 0; int i =3D 0; =20 - hexagon_read_memory(env, swi_info, 4, &physical_filename_addr, ret= addr); - hexagon_read_memory(env, swi_info + 4, 4, &filemode, retaddr); - hexagon_read_memory(env, swi_info + 8, 4, &length, retaddr); + if (get_user_u32(physical_filename_addr, swi_info) || + get_user_u32(filemode, swi_info + 4) || + get_user_u32(length, swi_info + 8)) { + goto do_fault; + } =20 if (length >=3D BUFSIZ) { qemu_log_mask(LOG_GUEST_ERROR, - "%s: filename too large (%d)\n", + "%s: filename too large (%" PRIu32 ")\n", __func__, length); semi_cb(cs, -1, ENAMETOOLONG); break; } =20 do { - hexagon_read_memory(env, physical_filename_addr + i, 1, - &filename[i], retaddr); + if (get_user_u8(filename[i], physical_filename_addr + i)) { + goto do_fault; + } i++; } while (filename[i - 1]); =20 @@ -513,6 +524,7 @@ static void sim_handle_trap0(CPUHexagonState *env) ret =3D guestfd; } } + unlock_user(filename, physical_filename_addr, 0); semi_cb(cs, ret, err); } break; @@ -531,7 +543,9 @@ static void sim_handle_trap0(CPUHexagonState *env) case HEX_SYS_ISTTY: { int fd; - hexagon_read_memory(env, swi_info, 4, &fd, retaddr); + if (get_user_u32(fd, swi_info)) { + goto do_fault; + } semi_cb(cs, isatty(fd), 0); } break; @@ -540,8 +554,10 @@ static void sim_handle_trap0(CPUHexagonState *env) { int fd; target_ulong off; - hexagon_read_memory(env, swi_info, 4, &fd, retaddr); - hexagon_read_memory(env, swi_info + 4, 4, &off, retaddr); + if (get_user_u32(fd, swi_info) || + get_user_u32(off, swi_info + 4)) { + goto do_fault; + } semihost_sys_lseek(env_cpu(env), common_semi_ftell_cb, fd, off, GDB_SEEK_SET); } @@ -556,13 +572,17 @@ static void sim_handle_trap0(CPUHexagonState *env) char filename[BUFSIZ]; target_ulong physical_filename_addr; target_ulong statBufferAddr; - hexagon_read_memory(env, swi_info, 4, &physical_filename_addr, ret= addr); + if (get_user_u32(physical_filename_addr, swi_info) || + get_user_u32(statBufferAddr, swi_info + 4)) { + goto do_fault; + } =20 if (what_swi =3D=3D HEX_SYS_STAT) { int i =3D 0; do { - hexagon_read_memory(env, physical_filename_addr + i, 1, - &filename[i], retaddr); + if (get_user_u8(filename[i], physical_filename_addr + i)) { + goto do_fault; + } i++; } while ((i < BUFSIZ) && filename[i - 1]); rc =3D stat(filename, &st_buf); @@ -590,8 +610,6 @@ static void sim_handle_trap0(CPUHexagonState *env) sys_stat.mtime =3D cpu_to_le32(st_buf.st_mtime); sys_stat.ctime =3D cpu_to_le32(st_buf.st_ctime); } - hexagon_read_memory(env, swi_info + 4, 4, &statBufferAddr, retaddr= ); - for (int i =3D 0; i < sizeof(sys_stat); i++) { hexagon_write_memory(env, statBufferAddr + i, 1, st_bufptr[i], retaddr); @@ -604,8 +622,10 @@ static void sim_handle_trap0(CPUHexagonState *env) { int fd; off_t size_limit; - hexagon_read_memory(env, swi_info, 4, &fd, retaddr); - hexagon_read_memory(env, swi_info + 4, 8, &size_limit, retaddr); + if (get_user_u32(fd, swi_info) || + get_user_u64(size_limit, swi_info + 4)) { + goto do_fault; + } semihost_sys_ftruncate(cs, semi_cb, fd, size_limit); } break; @@ -619,16 +639,17 @@ static void sim_handle_trap0(CPUHexagonState *env) =20 int i =3D 0; =20 - hexagon_read_memory(env, swi_info, 4, &FileNameAddr, retaddr); + if (get_user_u32(FileNameAddr, swi_info) || + get_user_u32(BufferMode, swi_info + 4)) { + goto do_fault; + } do { - hexagon_read_memory(env, FileNameAddr + i, 1, &filename[i], - retaddr); + if (get_user_u8(filename[i], FileNameAddr + i)) { + goto do_fault; + } i++; } while ((i < BUFSIZ) && (filename[i - 1])); filename[i] =3D 0; - - hexagon_read_memory(env, swi_info + 4, 4, &BufferMode, retaddr); - rc =3D access(filename, BufferMode); semi_cb(cs, rc, rc =3D=3D 0 ? 0 : errno); } @@ -641,8 +662,10 @@ static void sim_handle_trap0(CPUHexagonState *env) uint32_t BufferSize; uint32_t rc =3D 0, err =3D 0; =20 - hexagon_read_memory(env, swi_info, 4, &BufferAddr, retaddr); - hexagon_read_memory(env, swi_info + 4, 4, &BufferSize, retaddr); + if (get_user_u32(BufferAddr, swi_info) || + get_user_u32(BufferSize, swi_info + 4)) { + goto do_fault; + } =20 if (!getcwd(cwdPtr, PATH_MAX)) { err =3D errno; @@ -676,7 +699,9 @@ static void sim_handle_trap0(CPUHexagonState *env) case HEX_SYS_FTELL: { int fd; - hexagon_read_memory(env, swi_info, 4, &fd, retaddr); + if (get_user_u32(fd, swi_info)) { + goto do_fault; + } semihost_sys_lseek(cs, common_semi_ftell_cb, fd, 0, GDB_SEEK_CUR); } break; @@ -720,6 +745,11 @@ static void sim_handle_trap0(CPUHexagonState *env) "unknown swi request: 0x%" PRIx32 "\n", (uint32_t)what_swi); semi_cb(cs, -1, ENOSYS); + break; + + do_fault: + semi_cb(cs, -1, EFAULT); + break; } } =20 --=20 2.34.1 From nobody Fri Oct 23 14:30:37 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=oss.qualcomm.com ARC-Seal: i=1; a=rsa-sha256; t=1792161100; cv=none; d=zohomail.com; s=zohoarc; b=PMENHsLRcI9cQbkU59st/h0JcGgtVCiNyd0+j3dztbVnODKy71IPvLkehPFLH41x8/TqXul3qUJgCYZuqum5UVaQ1PY1iFMlW6CMwMSQfZrFifYDgHvBt70z7JldyEZiSJp6UTLsyEhNXZyQ04DRZNSCGxspJIGEGulNQWYHVFs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792161100; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=8knKJBhj3CLwKwN6vF7qBkMxkEJddyI8exnFWWUW0Y4=; b=jToCNWNrvOWsN4iYcj/shRWZXG50VbM2ra6RlfFys/hsj6KDab0vnEFTJ0vEI1TaNawrFMZlROmwxHOzVCBRCiw3Xw7Emy+xDe8QykDjE/IIuWxfgFGZwNEQREuHoDrXYSjgZfhY/+lusKtTk/kQ+xfZDx30bskxE0Pmdd5R7hI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792161100746146.62637062360625; Fri, 16 Oct 2026 07:31:40 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xHiwx-0004nT-G5; Fri, 16 Oct 2026 10:30:23 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xHiwv-0004mr-2n for qemu-devel@nongnu.org; Fri, 16 Oct 2026 10:30:21 -0400 Received: from mx0b-0031df01.pphosted.com ([205.220.180.131]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xHiwt-0007eR-7z for qemu-devel@nongnu.org; Fri, 16 Oct 2026 10:30:20 -0400 Received: from pps.filterd (m0279868.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 69GE5oW32153791 for ; Fri, 16 Oct 2026 14:30:18 GMT Received: from mail-vk1-f197.google.com (mail-vk1-f197.google.com [209.85.221.197]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4hbhumrwa6-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Fri, 16 Oct 2026 14:30:17 +0000 (GMT) Received: by mail-vk1-f197.google.com with SMTP id 71dfb90a1353d-5da613f7588so7399458e0c.2 for ; Fri, 16 Oct 2026 07:30:17 -0700 (PDT) Received: from hu-bcain-lv.qualcomm.com (Global_NAT1.qualcomm.com. [129.46.96.20]) by smtp.gmail.com with ESMTPSA id 71dfb90a1353d-5ea9b474b2asm1605214e0c.4.2026.10.16.07.30.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Oct 2026 07:30:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= 8knKJBhj3CLwKwN6vF7qBkMxkEJddyI8exnFWWUW0Y4=; b=fJPgfenK3KO+U114 cu9M7qg1iFuCPETelCrKpLgTEq9cA5+BSZe0mHvXROfZ/2YKwP5qJsXhnIJGoR06 piXxOfc2RZ+683sUGUx/mVmLIRg/Td5X5dqelb614y+hXtv/uISvlCAEep6yTCLV rsISnel6sDEGDI/LRh5vhmYirQEhtGriQQXg0fQyxiADj7CNFPBL2bPlDnN3bGzT j35n4maQeEdwKgSCUfz3E8O0ywRESA0My8Pc9nYgpyoIkpt1AmLlURYMqC8CihI1 nrflbHzoHlBaM88MIBzBfIKtwaUBibkL+7UjBSthUWX9ZC/apKotzuvPlnwKjEZd AmfJqQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1792161017; x=1792765817; darn=nongnu.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=8knKJBhj3CLwKwN6vF7qBkMxkEJddyI8exnFWWUW0Y4=; b=TCryi0Y1ON4Xft+/sekw234ex/lGfUqCyn+a0Iw++QttKgtoiIrasTqHaWbeQQxAM5 I1Vew+ZiePDkIBmXI+ewzw3/wdxbBE9AOiNpzpLvwq9MVBE0CnNRUCkAvjuMN0dzExJR 6hU067Ezxrvm+AFyhemcoiJc+YvE0urzjvdmUmADMDoL7VKYdR2GR+nwC59a55fMMKUd UXWdU4YKNqmYZceIeRtLmItNkBUj3KqXMB4H1knQfhiMOzdrM4yieEMij1ZqTv/ywh/H QOJfzpUgErvw29HLJhclk7ygIJqUg3kNeaGNnw9iWbQUJd3DvPHrlhvHC5NZ+oB4VW7C 9CrA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792161017; x=1792765817; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=8knKJBhj3CLwKwN6vF7qBkMxkEJddyI8exnFWWUW0Y4=; b=KpIMRLTA7AUnS0V1L4AxTQGwPOPnDhuBq8i2m92wMK1qpur0vtZp9TfE6koOB+3Pzv oPQuIEzx30e1OxCHI5joenOiv2kI1g2J0iCzggEA0AKdPqHdOp+M+GMtLjDPj2TnnCFS E4ruhcjOgg3zljjSBY6mb2hxIoYKVjDFVZ44IVXn5dl4nT9O2fk5YoRLYyE01zRb/tb3 FVycV86wEkwvQbInfuJ6J7gnPO1OrPN2ZiagJd9T3pHsAmxt/UxcmJhYDuK6o8kSCam6 tK7PTvvH+Wgnl3qEQvSBls1WeGq5NugFQ+XGywSMtRGjcbIVponNSILtP9nG9/ek7kfs nleA== X-Gm-Message-State: AFq9FYJXLlt8Xsv6nNaYfKnHZq2VKe7q8SpEYh1g0qBH1p37R3Gd1kd7 xKOWIomeHPLLSqakSv6okc3U4n1nm/0HeUJUg8um2lSSHw+InAh3surTam7ver8wzZu2F//CSY/ NXK0dNBlczKSAxRodQElR/CY5IPQHpLV/P76vUIpMYVDgCsm6LQ3UJStqRXeDhDtrVw== X-Gm-Gg: AYBFou3uXVL3duFy2Y3/L8+8SddwTbgjRQaLpYDrEBcpaOD7uFr1dGPZoyk34RtY9rO 6jDH3FOWBX5fd0qTr0//SJyrDlFML8rSzpjyCCoVrngQffweaX4lTtyeziVhHXaAYB6IdkmrKNI VuAsglKcCbDVpOF4sBoJ/s7tsGciTRoS+skRIUvxAnMyTFMvyxmvanIpunjrtc68AFwmbRM8ZT9 l+2UMX6HG2bONpm97nMAnlsTa7JnBDO2f4fxo58qP+1K41BhWc0SjY6kMJ2INGsRwAfXEJzMq5A rElbSOFOa1KwZGjrCxiHeF2ZghvqgFy+AZNTqbtjqIihYWugfZMV74jCgG5CHygWYAlT5jxQSo6 kleZU82WloSlcdMFVEMLPArE0AawmFnfwEEIMHFUvCDX90is= X-Received: by 2002:a05:6122:54b:b0:5ea:a427:fdc with SMTP id 71dfb90a1353d-5eaaa0f99bamr117913e0c.3.1792161015370; Fri, 16 Oct 2026 07:30:15 -0700 (PDT) X-Received: by 2002:a05:6122:54b:b0:5ea:a427:fdc with SMTP id 71dfb90a1353d-5eaaa0f99bamr117829e0c.3.1792161013406; Fri, 16 Oct 2026 07:30:13 -0700 (PDT) From: Brian Cain To: qemu-devel@nongnu.org Cc: philmd@oss.qualcomm.com, Pierrick Bouvier , peter.maydell@linaro.org, Brian Cain Subject: [PATCH v4 2/4] target/hexagon: fix semihosting OPEN filename handling Date: Fri, 16 Oct 2026 07:30:05 -0700 Message-Id: <20261016143007.3474704-3-brian.cain@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20261016143007.3474704-1-brian.cain@oss.qualcomm.com> References: <20261016143007.3474704-1-brian.cain@oss.qualcomm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Proofpoint-Spam-Info: AW1haW4tMjYxMDE2MDA1NyBTYWx0ZWRfX08eYd3n5vE23 XSpgL/I5IT2n1mU0Ci6GqKA9YHjm4LIBiJ/V8WHNoEa/SxjhujQMSdEhUCAipaWbHv2qghmbVd6 xzafYgGBwUSKus+Fn1FsxET/0H7Vd1A= X-Authority-Analysis: v=2.4 cv=H+BOUOYi c=1 sm=1 tr=0 ts=6ad234f9 cx=c_pps a=JIY1xp/sjQ9K5JH4t62bdg==:117 a=ouPCqIW2jiPt+lZRy3xVPw==:17 a=IkcTkHD0fZMA:10 a=660iZSQnnn4A:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=ZpdpYltYx_vBUK5n70dp:22 a=VwQbUJbxAAAA:8 a=pGLkceISAAAA:8 a=KKAkSRfTAAAA:8 a=EUspDBNiAAAA:8 a=ykWGg2PKCrmQVCz4z_YA:9 a=QEXdDO2ut3YA:10 a=tNoRWFLymzeba-QzToBc:22 a=cvBusfyB2V15izCimMoJ:22 X-Proofpoint-GUID: J74IiMcNse2kQz-jB7U24J6T0g8Xk9c3 X-Proofpoint-ORIG-GUID: J74IiMcNse2kQz-jB7U24J6T0g8Xk9c3 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDE2MDA1NyBTYWx0ZWRfX2z1KKP2H5DlH UfTpon0Ee2d+mQ82vvNKuaRZMDlaKtaa8/42ZNw8la8HzNJI0TDGdwVJ/ef6ojNMmC/rmpwmDgI vrFxU4rZbc/Zj0VTJMxHIJhN2nDWDBqwTl2WIonA+P69DM+XxCqnKukraz55AeiCIzNCTd0NDJw +HcSHdDXtdGnsV4F8uSLhD+RpMGSGaJDLrJmIdBa75i1iqMINH5DUyyGwW0Lm4y1MvbOMjdxShQ xo+k0PdYN1kwnsqFSAqGkvRSRWhZBGH9ZLVZiIrFzCGa/UJwZ+UtmGY2lA4KiLbgcu1C3KGTsCl U76qB3xgeY5uY9jlUdpL+qthHUyPaBAqfbjqYh1UNBzHr0Fp2NCCmu4rXpcQVZeistUuFqpVrLm rAAxQ9IbbDBWEUEDIq0aF0D2bKlEaplB9r2lXFyYicdHkGUrxhuFqjBzqHI+ST7kGWY52uFXJQG 0IrAanHX5zd18GCBngw== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-16_02,2026-10-14_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 malwarescore=0 bulkscore=0 phishscore=0 priorityscore=1501 adultscore=0 clxscore=1015 lowpriorityscore=0 impostorscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2610080000 definitions=main-2610160057 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=205.220.180.131; envelope-from=brian.cain@oss.qualcomm.com; helo=mx0b-0031df01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @qualcomm.com) X-ZM-MESSAGEID: 1792161102272158500 HEX_SYS_OPEN copied guest bytes into a fixed-size buffer until it found a NUL. A missing terminator could overrun that buffer. Use lock_user() with the ABI filename length and validate its terminating NUL before opening it. Fixes: 7711fdba88b ("target/hexagon: add main arch-specific semihosting ope= rations") Link: https://lore.kernel.org/all/CAFEAcA9MOs6VfHf2UHZ8z4cdvaB+7DY6hJb2emYZ= 2aLSe-t6iw@mail.gmail.com/ Suggested-by: Peter Maydell Signed-off-by: Brian Cain Reviewed-by: Peter Maydell --- target/hexagon/hexswi.c | 29 ++++++++++++----------------- 1 file changed, 12 insertions(+), 17 deletions(-) diff --git a/target/hexagon/hexswi.c b/target/hexagon/hexswi.c index bc809594335..cc48c9ba9f1 100644 --- a/target/hexagon/hexswi.c +++ b/target/hexagon/hexswi.c @@ -469,35 +469,29 @@ static void sim_handle_trap0(CPUHexagonState *env) =20 case HEX_SYS_OPEN: { - char filename[BUFSIZ]; + char *filename; target_ulong physical_filename_addr; unsigned int filemode; - uint32_t length; + uint32_t filename_len; + size_t filename_size; int real_openmode; int ret, err =3D 0; - int i =3D 0; =20 if (get_user_u32(physical_filename_addr, swi_info) || get_user_u32(filemode, swi_info + 4) || - get_user_u32(length, swi_info + 8)) { + get_user_u32(filename_len, swi_info + 8)) { goto do_fault; } =20 - if (length >=3D BUFSIZ) { - qemu_log_mask(LOG_GUEST_ERROR, - "%s: filename too large (%" PRIu32 ")\n", - __func__, length); - semi_cb(cs, -1, ENAMETOOLONG); - break; + /* The ABI length excludes the filename's terminating NUL. */ + filename_size =3D (size_t)filename_len + 1; + filename =3D lock_user(VERIFY_READ, physical_filename_addr, + filename_size, true); + if (!filename || filename[filename_len] !=3D '\0') { + unlock_user(filename, physical_filename_addr, 0); + goto do_fault; } =20 - do { - if (get_user_u8(filename[i], physical_filename_addr + i)) { - goto do_fault; - } - i++; - } while (filename[i - 1]); - /* convert ARM ANGEL filemode into host filemode */ if (filemode < ARRAY_SIZE(angel_to_host_filemode_table)) { real_openmode =3D angel_to_host_filemode_table[filemode]; @@ -505,6 +499,7 @@ static void sim_handle_trap0(CPUHexagonState *env) qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid OPEN mode: %u\n", __func__, filemode); + unlock_user(filename, physical_filename_addr, 0); semi_cb(cs, -1, EINVAL); break; } --=20 2.34.1 From nobody Fri Oct 23 14:30:37 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=oss.qualcomm.com ARC-Seal: i=1; a=rsa-sha256; t=1792161095; cv=none; d=zohomail.com; s=zohoarc; b=BUXF3FVFm6brppIgOlySKlHbv3e4uZg+CRzFiv806tmumVnEfIgQi6U/5aQJBwGOSEN28cnSJETo8CTDDOdEhyz/hgTlgUBbid1myVm+emHSxlxwHXiQf1Sj0AzpZcrYzXjwL6FphjwDGh1aTncoxi7m6AwAopiedZGEL7w+Jpk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792161095; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Enf2W/dFQxa7P2tBTeMCV59yWp+gzwwLwHLrsTYW8WY=; b=UZ12M7aM190QBfAeMhmNJc8NgbxmNgpS9I3PWGaT/hyI6l/RLUB8Ym17jlseRxwFWGa0Sx3IOw57SXeVpBZ4gu4pz6lV9LzJ6wlu2AOGjFCf+oFqYfS+B/CYQYQiowkCx3/rK92QFL+kPV4w+NjUXqtUd8/f9/t7drOWEBtAV/Y= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792161095697268.32446143673917; Fri, 16 Oct 2026 07:31:35 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xHiwz-0004oQ-NE; Fri, 16 Oct 2026 10:30:25 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xHiww-0004nS-Tv for qemu-devel@nongnu.org; Fri, 16 Oct 2026 10:30:23 -0400 Received: from mx0a-0031df01.pphosted.com ([205.220.168.131]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xHiwu-0007eX-Jx for qemu-devel@nongnu.org; Fri, 16 Oct 2026 10:30:22 -0400 Received: from pps.filterd (m0279863.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 69GE6Ldi2494819 for ; Fri, 16 Oct 2026 14:30:18 GMT Received: from mail-vk1-f199.google.com (mail-vk1-f199.google.com [209.85.221.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4hb8a8b1vu-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Fri, 16 Oct 2026 14:30:18 +0000 (GMT) Received: by mail-vk1-f199.google.com with SMTP id 71dfb90a1353d-5e944179148so2759039e0c.3 for ; Fri, 16 Oct 2026 07:30:18 -0700 (PDT) Received: from hu-bcain-lv.qualcomm.com (Global_NAT1.qualcomm.com. [129.46.96.20]) by smtp.gmail.com with ESMTPSA id 71dfb90a1353d-5ea9b474b2asm1605214e0c.4.2026.10.16.07.30.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Oct 2026 07:30:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= Enf2W/dFQxa7P2tBTeMCV59yWp+gzwwLwHLrsTYW8WY=; b=mcxSFmquqwAIbuP6 QiTAykyAc0mBsLDXpPYwFnnfjkoFLcr11X+UdM5pZtyVeX/PEdd+QaDiBpnQUDJI yHEGfT5f92sPoGT54ZIKHQgSnoKpIb/ygaDqJjBaFwbQ+5z6Gp6eIx3rjCAT90Sk oAUI0FFLIHF0OwU87b8dhDNLvE7XyYr/YwIbkQIPRtpEzWeB1SkBF70nxwRMXMY9 T2XQdfGKP71tg+5gaGSvsUilZE8cp2FuZpgdGId/dk5hq7dIX0kpdDPg3i2rq+Bm eg2Bc7rQN2utSBNAlVC8ZnYMKTJzzMKV+oIzA7OGFxOAAfdNa36XCzSCM8QIslco ZK4Tnw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1792161017; x=1792765817; darn=nongnu.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=Enf2W/dFQxa7P2tBTeMCV59yWp+gzwwLwHLrsTYW8WY=; b=EMjSUllE5GTTc4PwLTtZhSqYzGM7OIK4YqqKrk18V7S0Eb14vN71FHEFPQShmV14hq Uhot9gU+OLIGlHXwNODPYgYKaUTiRpcM6heMsyD8Ay4dpd6eEd/SoZLS7BmlS5uM+C63 KOaXUVLI5YFYIUfos2a3YUN15XiYGOiQbsx968R3bEm+OotHFEXYNyE3y2HEqSUdiNOs eVryTg/MQd3MU7A15rqxw/jvbdsXR0VsqspsE1X15EQlJdKCfxx/3GAkRijZWVkgRXVJ rKq8ZRL6dG6bJv6hF98b7hBhMyreAkNc6D8r6ypGITPsqNtiU//rnpZmWeN/xFYu9L8U f3Wg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792161017; x=1792765817; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=Enf2W/dFQxa7P2tBTeMCV59yWp+gzwwLwHLrsTYW8WY=; b=jd4POYq9oWj9vtGqtqz6Y67xniiLGSjYtRYDEjb7Ul0d6c2QygWeY42hXaCsHiUlAb 4+B6S8MXY2djIhzfiNzuWf4YPDvypFKRcBxxF3qzUmRCSvLX0K+D8k97Y1FIyuuKcB7k eU2QDR7INZK23fCHnwkCGv6bj0mAyLWOZ8BEW3w278BaoCAR9oYdeaO7qipipB7/99Sp WsmSBq4Qie9pQOmEru4aNUPoBFlR+JX4upLTwtrG9oKpar9006d9IgI0xLMtRDIMKkq/ Bq1UujR3Q+9+mm1DmcKg7b5V7P8jQDq9PxBSgBo2fMT9ntolncAkw01Lc1YHWgpGXpl9 QaEQ== X-Gm-Message-State: AFq9FYJIfqhH2gJ+GNqlCgfvs30+427c5s9cYJL/xqrcUc9qorDESGKG Nf1+gQBHHCQeuuij+uQLaZrTFvzZLywp38QkYq5VBVSIxmoHLf9eE4dJFSDJTB2AA/v9uWTGRPG QqvpOPj8tqpUqJ4zWa02jtWNIRMWM7SZxG659H3iyUjKNfEl98vgDFjqOmsYPmBylVQ== X-Gm-Gg: AYBFou1cq3qVr3X7EhGKyndCDf8WGhOS1BH23sWmqRPhvfWTxnLdIlonjLGr/yyFky4 ZeXE2crkpVqllwigynBAkW8vkdi7NNZvHPxTSzVKoRuelUbLUqbCz1YYflfGaPkFsuxQs+ZHNab vhNLyowVFzV3lMhpPEcZI7sr6ZwYi14JFgzBElz1lxWnSkPdBkJ+f3h5/sYeWqNfM5lG8g+7ghI 5/Q8lBmDR19VSlPThmW0ugs+G6A9OFWDvSVzvvmO9LahpJN1E6h1zZali/PcE04l6rhgqQKb3xb NSPtPH696zVhuN9fqckW0Lxny/qjEzAuh/Rd3Lud/iQkgSvi0guYF4Z7seXB6npCmcgf2uDMV6j 7kzqQD15eLE1HSBFAsdIuQWudJQR5fGR5Ri58wem4m7sqNtA= X-Received: by 2002:a05:6122:1d8d:b0:5e9:7c82:9a05 with SMTP id 71dfb90a1353d-5eaaa409045mr104657e0c.9.1792161016952; Fri, 16 Oct 2026 07:30:16 -0700 (PDT) X-Received: by 2002:a05:6122:1d8d:b0:5e9:7c82:9a05 with SMTP id 71dfb90a1353d-5eaaa409045mr104631e0c.9.1792161016174; Fri, 16 Oct 2026 07:30:16 -0700 (PDT) From: Brian Cain To: qemu-devel@nongnu.org Cc: philmd@oss.qualcomm.com, Pierrick Bouvier , peter.maydell@linaro.org, Brian Cain Subject: [PATCH v4 3/4] target/hexagon: fix semihosting STAT filename handling Date: Fri, 16 Oct 2026 07:30:06 -0700 Message-Id: <20261016143007.3474704-4-brian.cain@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20261016143007.3474704-1-brian.cain@oss.qualcomm.com> References: <20261016143007.3474704-1-brian.cain@oss.qualcomm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Proofpoint-Spam-Info: AW1haW4tMjYxMDE2MDA1NyBTYWx0ZWRfXws9RON+QFGTe 6uIcp+zfKOhOt74qObunCNRBtoxsDXZYYjT9zoOPdvQCKq9PsT5vDP5WxNGlIl9dYuJ7CZv56q5 BP6Xt1yh82s7y+wmmqt/ecsUmrLJSqU= X-Proofpoint-ORIG-GUID: UiUYK2faIdnDFFRJlot-2kscf4trHvC8 X-Authority-Analysis: v=2.4 cv=GJadgeNK c=1 sm=1 tr=0 ts=6ad234fa cx=c_pps a=+D9SDfe9YZWTjADjLiQY5g==:117 a=ouPCqIW2jiPt+lZRy3xVPw==:17 a=IkcTkHD0fZMA:10 a=660iZSQnnn4A:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=yOCtJkima9RkubShWh1s:22 a=VwQbUJbxAAAA:8 a=pGLkceISAAAA:8 a=KKAkSRfTAAAA:8 a=EUspDBNiAAAA:8 a=FZZFJ5KotruyPtQxbZcA:9 a=QEXdDO2ut3YA:10 a=vmgOmaN-Xu0dpDh8OwbV:22 a=cvBusfyB2V15izCimMoJ:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDE2MDA1NyBTYWx0ZWRfX9pxXE+vQzxTf 1EQwTlQYBM4jRVRxCnFSLnCegPDemQBUL8Y9a/V06nuCdYIk/jS5yt5GRTyS0QHW842yNM1L7Tj EKjSdqzXlBjlb3tAifMvYRsiMiYWCAIszYNCbtXWwajVCyukzp2I2DNjRMlWpMLfcoRcDk1vUKV mZYSNuaHV3n83y8c3gt9qX50hTgS4InriuyT/jSO6/duVqt+fZ1qnkU+fHvGm1zRM1VqAaSLiTL qwp2Vd9yfdz8LZICs/ckmDx6Tx917KXwGPt4r7FI9cYEv9ITUQVdcQ1zAuBU1qmMibp9hjD970S PkBZkD1680N1nDas4aiXYo63BTFTKa5KjqULy3QDir/lHuDW3OZNlcn5k5MgE4N25xZEBE0X9uR Qdt7lYPLK3KgbOjMCD41PPbp1NJdaGcdIe5R9/pjvqSqDvTm8W67hIC/nKoR4e+Si7p2IyfKyzO x9ZGc3CZKgpYpws0wiA== X-Proofpoint-GUID: UiUYK2faIdnDFFRJlot-2kscf4trHvC8 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-16_02,2026-10-14_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 impostorscore=0 spamscore=0 malwarescore=0 lowpriorityscore=0 bulkscore=0 priorityscore=1501 phishscore=0 adultscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2610080000 definitions=main-2610160057 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=205.220.168.131; envelope-from=brian.cain@oss.qualcomm.com; helo=mx0a-0031df01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @qualcomm.com) X-ZM-MESSAGEID: 1792161096219158500 HEX_SYS_STAT could pass an unterminated local filename buffer to stat() when the guest string filled it. Use lock_user_string() to map the guest string safely. Fixes: 7711fdba88b ("target/hexagon: add main arch-specific semihosting ope= rations") Link: https://lore.kernel.org/all/CAFEAcA9MOs6VfHf2UHZ8z4cdvaB+7DY6hJb2emYZ= 2aLSe-t6iw@mail.gmail.com/ Suggested-by: Peter Maydell Reviewed-by: Peter Maydell Signed-off-by: Brian Cain --- target/hexagon/hexswi.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/target/hexagon/hexswi.c b/target/hexagon/hexswi.c index cc48c9ba9f1..a5c8ee27c7e 100644 --- a/target/hexagon/hexswi.c +++ b/target/hexagon/hexswi.c @@ -564,7 +564,7 @@ static void sim_handle_trap0(CPUHexagonState *env) struct stat st_buf; uint8_t *st_bufptr =3D (uint8_t *)&sys_stat; int rc, err =3D 0; - char filename[BUFSIZ]; + char *filename; target_ulong physical_filename_addr; target_ulong statBufferAddr; if (get_user_u32(physical_filename_addr, swi_info) || @@ -573,15 +573,14 @@ static void sim_handle_trap0(CPUHexagonState *env) } =20 if (what_swi =3D=3D HEX_SYS_STAT) { - int i =3D 0; - do { - if (get_user_u8(filename[i], physical_filename_addr + i)) { - goto do_fault; - } - i++; - } while ((i < BUFSIZ) && filename[i - 1]); + filename =3D lock_user_string(physical_filename_addr); + if (!filename) { + semi_cb(cs, -1, EFAULT); + break; + } rc =3D stat(filename, &st_buf); err =3D errno; + unlock_user(filename, physical_filename_addr, 0); } else { int fd =3D physical_filename_addr; GuestFD *gf =3D get_guestfd(fd); --=20 2.34.1 From nobody Fri Oct 23 14:30:37 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=oss.qualcomm.com ARC-Seal: i=1; a=rsa-sha256; t=1792161059; cv=none; d=zohomail.com; s=zohoarc; b=HHVwxRft+8Jyf1qBPwACzvZOap0XhAA6NqHsoQevixZhLo8fWJe9loDR81NaXNXWkQ8Fj+0CKPvNlhW/1TWgOY8dXM3p9OkP/bDkp4akQ56ASCgXetgL68RfOc5WwWaLayHcbePJ6NiB1ATYmtW7AEGvbovJZo9PXyPLlKPa9uk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792161059; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=UebSHfNGHCnl3lV5FG/Q9b7I36P06qarQ39hZQcc+E0=; b=TQB4aP7DyVeLtcVuEfJ8wOhr3w8m5CsbF84gjA+4OSU3Q+G5jTlnuXMPNUi5r7p28P7uMXca7T1ASJ75Pw4LyQFFpsYGc9YNXCd5iyGk7LhJMrPodKCbARn76Quvfquxg3tip1t25BqWKCt5ZKI6M9aj6qyt0QU/PdTU5Frn57E= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792161059874337.80679551194225; Fri, 16 Oct 2026 07:30:59 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xHix0-0004ob-Fd; Fri, 16 Oct 2026 10:30:26 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xHiwx-0004nc-Hd for qemu-devel@nongnu.org; Fri, 16 Oct 2026 10:30:23 -0400 Received: from mx0a-0031df01.pphosted.com ([205.220.168.131]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xHiwv-0007ej-Ak for qemu-devel@nongnu.org; Fri, 16 Oct 2026 10:30:23 -0400 Received: from pps.filterd (m0279866.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 69GE5ajW1613245 for ; Fri, 16 Oct 2026 14:30:20 GMT Received: from mail-vk1-f197.google.com (mail-vk1-f197.google.com [209.85.221.197]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4hbk3v0m5v-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Fri, 16 Oct 2026 14:30:19 +0000 (GMT) Received: by mail-vk1-f197.google.com with SMTP id 71dfb90a1353d-5de9d3d00acso2940191e0c.0 for ; Fri, 16 Oct 2026 07:30:19 -0700 (PDT) Received: from hu-bcain-lv.qualcomm.com (Global_NAT1.qualcomm.com. [129.46.96.20]) by smtp.gmail.com with ESMTPSA id 71dfb90a1353d-5ea9b474b2asm1605214e0c.4.2026.10.16.07.30.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Oct 2026 07:30:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= UebSHfNGHCnl3lV5FG/Q9b7I36P06qarQ39hZQcc+E0=; b=VG5z11j7MkCMNKzl CDJ+2HZCXGlcyn2paH3VSjc+7ZARlyTSsYD7/Ox54Nupiat3/9DQn6NMS+PyZyJq 6hWw1l15yGeAPd4x92nbgQN4rzXxIgR/HX2Y8bN5L4REVYo2lC4UPr7O/G2TSCNU FTv2xhJ5JVaahAUaq3PzZOcAQhyHDypEZYavWq/WTwg9hv2OAWQU/axP14nrYshB rS52SCdaFjKAv2piM+FjAU4vpVFctX9F4mH0pjyml4Ni8lgufAO0Y/C58iNxad30 RnDCPLm9zvXqxVOX0JNix/MKzHXkEPJ0yErwe3tyCpxed1bCTdqdeUhLWhn2fQYp wiwqww== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1792161019; x=1792765819; darn=nongnu.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=UebSHfNGHCnl3lV5FG/Q9b7I36P06qarQ39hZQcc+E0=; b=L4atZeIaYnAFvoXyjJIxieQEAdc8nwz5H1cHn4dblgMWMPBqOBscY9QY7u3mbG8gs3 0mjr0vXkn4RYpEi+SkXsViWLUHJs6ueeWVsUEcu7EVXnO5kCvMrwvlBXtS6kRqxI+IDy 9Rq4X5ZhZogxzXWmbMp0bnLb6TSO6W4/5rS07oC4M8XIigj4OgV00ZkBTJPbBeWziDPM hTA7U47JyS8Pk8tINspzJWV2staO8YSFC3ChQRmUewq5Fe50PzUDB3E8NLK6dNR0Q3cJ Yrxak3j0yS+7x27LumnDJ8BZEUf0vH4+Sw51EFp7zquDtG0FI3VwwRL+mdJ7rJLIzjPe Ve7w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792161019; x=1792765819; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=UebSHfNGHCnl3lV5FG/Q9b7I36P06qarQ39hZQcc+E0=; b=1yuo+kue2SRHqByP4llAhQjwZslvZ/5vrK+o5h4LVcN4zOk2kzd14pi2Bp1FFk7tby OAqvKX8m8WkWOefuT6K2dOKV1w+IncHKwld5Bet3/p45bQDFTvUISwUe+VwB9y1Pz2/4 fsL7qeUE6R5RZGp2zG8smZaF6uRton3Hb6UzrEfwEuhRQCx75Ar1pSeTetnVfA3W4Fsi +Hl9CKvc0T14xEcUwpoLT3kW/iufi7/edTyMYZ63uKjT6Gdj21viQWCnrMRD69/xrdNn 8noLNsmBKv8kCSqXf259r6fzCUpU5LEy7+H+B4isbLH4AiunrhKDf8/nX5sNTpUCvmFN MQ4Q== X-Gm-Message-State: AFq9FYLwq5sEWeNzB1obRoxocp24K8tCG7Nb8MRRpXckO4JWDRm7Aovr MoW0b8if0mincRnIOdNo00J3cQnbrdLLip4q5VDOEDJMaFQHaEEl/tBtCDAN8t9yJxqlu0n59O6 /BWt3k6z1DgI+sFyTkKd0VlFsFGRn9gDbKizzm0yEC2L27fmTmqT0dnuoADaiR1E+1g== X-Gm-Gg: AYBFou3QFWyzaCDpzlOTlcuiwJHQ+GStdRV8MpIVsG2Ra/nLMrTaUhn1JValwUBO3/1 68XVkXMfxMaYMZxdBCV+kVDrw139x/uQft7R+6k60/WJwd+HCiBk3yCXG41G9KD7lWbwAKFNtSC n2ete69/voVeJZbE66jESA2e9AZ1OCUfuUboUOe6aGmFm3UyMJjjf2fO0L/zX5hpo0WPoCIMTD0 cQCToWdDrXyzMyNJtUuh4Rf/kG8ofBtb/R4m32KHSHrMfLeWPbED9KoIv+pgQjUwNYjfbYdeb2h lnfRCwolMP8SRdZInvhBA0E1TaYQ/hAXAjKF646cGOPpptHOf9JISfEupAyQwj0rb5hhrxg8nsW dRlVJ/TnXNNyXICS1PLW8SfYpPJFSZHX5exX6OioF6tQlgZA= X-Received: by 2002:a05:6122:3a03:b0:5e9:fe71:58e4 with SMTP id 71dfb90a1353d-5eaaadcc42bmr89157e0c.23.1792161018909; Fri, 16 Oct 2026 07:30:18 -0700 (PDT) X-Received: by 2002:a05:6122:3a03:b0:5e9:fe71:58e4 with SMTP id 71dfb90a1353d-5eaaadcc42bmr89127e0c.23.1792161018421; Fri, 16 Oct 2026 07:30:18 -0700 (PDT) From: Brian Cain To: qemu-devel@nongnu.org Cc: philmd@oss.qualcomm.com, Pierrick Bouvier , peter.maydell@linaro.org, Brian Cain Subject: [PATCH v4 4/4] target/hexagon: fix semihosting ACCESS filename handling Date: Fri, 16 Oct 2026 07:30:07 -0700 Message-Id: <20261016143007.3474704-5-brian.cain@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20261016143007.3474704-1-brian.cain@oss.qualcomm.com> References: <20261016143007.3474704-1-brian.cain@oss.qualcomm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Proofpoint-GUID: kOEApouXSZXcWvb90XNzvA8hBQwOHUvk X-Proofpoint-Spam-Info: AW1haW4tMjYxMDE2MDA1NyBTYWx0ZWRfX53KI/zCc8T4O TyRICSOFAEhWzZDSYD56Guji7av6yBKZdbuExFshcWFsNsc7Qc0UBfzo1zKdlxWRIfsiiTGUHXo hA1ixV3ltlaE1eneIU/Bzac9rsTmtXg= X-Authority-Analysis: v=2.4 cv=BZdNQbt2 c=1 sm=1 tr=0 ts=6ad234fb cx=c_pps a=JIY1xp/sjQ9K5JH4t62bdg==:117 a=ouPCqIW2jiPt+lZRy3xVPw==:17 a=IkcTkHD0fZMA:10 a=660iZSQnnn4A:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=YMgV9FUhrdKAYTUUvYB2:22 a=VwQbUJbxAAAA:8 a=pGLkceISAAAA:8 a=KKAkSRfTAAAA:8 a=EUspDBNiAAAA:8 a=pS50CBgNNeok3lFgILkA:9 a=QEXdDO2ut3YA:10 a=tNoRWFLymzeba-QzToBc:22 a=cvBusfyB2V15izCimMoJ:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDE2MDA1NyBTYWx0ZWRfX18I5vQEFjsBq MZKsYjyQSr6w8eEZ9xHrri/SZt3H49FyDzOARbuS4NVW+eHKl/n9c2gHefCc9pY8MznrJROIkGV djqS7duCngj1RJtHvRLaUkQjREqsYB/Pv7v1oh7HIcg+8IbKRaNWJ0Ql2XiLvZBOV8Tic3sdjs2 RlEoC+NAgkMWK4n3oyz3zOFvfKc3UbzzPWcZvze7ZD/PLMrRObtn6fMPlexYHCyJqFyrllvk4Dt NwKZM/t4DO1azTRRBOq58oGkjtOOlF0Vz4qopyc3XjC9YZTBKqSTdaiEVyre9fKgHU6ao711YcR ++2nWoeiT5hczyiOC5Qw9Uvns3XFvoeX9dqByRB+drRgXRDL+mdqeH3o7/LPJ2mAhXcnyOhh+G/ MjxvEpJdAzG0WB86TQzibEBzmC8ryJUJAI3uyCFTM2XR/3iu3X+kecGq3PqXA/wh72HoBF/2zUG zLHzWyjCOc6RiTUWUcw== X-Proofpoint-ORIG-GUID: kOEApouXSZXcWvb90XNzvA8hBQwOHUvk X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-16_02,2026-10-14_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 clxscore=1015 impostorscore=0 priorityscore=1501 phishscore=0 malwarescore=0 adultscore=0 bulkscore=0 suspectscore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2610080000 definitions=main-2610160057 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=205.220.168.131; envelope-from=brian.cain@oss.qualcomm.com; helo=mx0a-0031df01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @qualcomm.com) X-ZM-MESSAGEID: 1792161061691158501 HEX_SYS_ACCESS wrote a NUL byte past its fixed-size filename buffer when the guest string filled it. Use lock_user_string() to avoid the out-of-boun= ds write. Fixes: 7711fdba88b ("target/hexagon: add main arch-specific semihosting ope= rations") Resolves: Coverity CID 1685942 Link: https://lore.kernel.org/all/CAFEAcA9MOs6VfHf2UHZ8z4cdvaB+7DY6hJb2emYZ= 2aLSe-t6iw@mail.gmail.com/ Suggested-by: Peter Maydell Reviewed-by: Peter Maydell Signed-off-by: Brian Cain --- target/hexagon/hexswi.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/target/hexagon/hexswi.c b/target/hexagon/hexswi.c index a5c8ee27c7e..9ff72253385 100644 --- a/target/hexagon/hexswi.c +++ b/target/hexagon/hexswi.c @@ -626,26 +626,24 @@ static void sim_handle_trap0(CPUHexagonState *env) =20 case HEX_SYS_ACCESS: { - char filename[BUFSIZ]; + char *filename; uint32_t FileNameAddr; uint32_t BufferMode; - int rc; - - int i =3D 0; + int rc, err; =20 if (get_user_u32(FileNameAddr, swi_info) || get_user_u32(BufferMode, swi_info + 4)) { goto do_fault; } - do { - if (get_user_u8(filename[i], FileNameAddr + i)) { - goto do_fault; - } - i++; - } while ((i < BUFSIZ) && (filename[i - 1])); - filename[i] =3D 0; + filename =3D lock_user_string(FileNameAddr); + if (!filename) { + semi_cb(cs, -1, EFAULT); + break; + } rc =3D access(filename, BufferMode); - semi_cb(cs, rc, rc =3D=3D 0 ? 0 : errno); + err =3D errno; + unlock_user(filename, FileNameAddr, 0); + semi_cb(cs, rc, rc =3D=3D 0 ? 0 : err); } break; =20 --=20 2.34.1